CVE-2026-71270

8.6 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows an attacker to exploit SSRF in Stirling-PDF by targeting unsecured conversion endpoints, leading to potential data exposure.
Exploitability: Exploitation requires access to the affected endpoint and knowledge of the SSRF vulnerability, making it moderately difficult.
Blast radius: If exploited, this could lead to unauthorized access to internal systems or sensitive information hosted on those systems.
Prioritized remediation: Implement SSRF protections in all conversion endpoints by updating ConvertWebsiteToPDF.java with CustomHtmlSanitizer/SsrfProtectionService.

ssrfpdfwebsecurity

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weaknesses

CWE-918

Public exploit & PoC references

https://github.com/Stirling-Tools/Stirling-PDF

All references

https://github.com/Stirling-Tools/Stirling-PDF

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.